tunnel
chisel
The open-source TCP/UDP tunnel, the single most shared piece of tooling across the actors tracked here. Named by 0 reports, 0 detection rules, 0 IOC feeds and 4 tracked actors.
Also written as: Chisel. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
No published report carries this family in a rule, feed or tag; it is named on actor profiles only.
Detection rules
No published YARA rule names this family in its metadata.
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-006: Stock AdaptixC2 operator with an operator-written PowerShell and .NET injection chain
- UTA-2026-018: Hands-on-keyboard operator exploiting four Southeast Asian governments with a bespoke edge-device toolkit
- UTA-2026-023: Telecom-focused operator reaching a carrier's credential plane through a customer's managed router
- UTA-2026-024: Windows post-exploitation intrusion set with Sliver and a blockchain-resolved implant
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.